It is being reported that, with effect from 1 December 2014, section 56 of the Data Protection Act 1998 (DPA) will be brought into force, which will make it a criminal offence to request an enforced subject access request.

What is an enforced subject access request?

Enforced subject access occurs where one person is compelled by another, for example an employer or prospective employer, to make a subject access request under the DPA and reveal the response.

Employers cannot apply for criminal records checks on employees or applicants, except in specific circumstances, and therefore such requests allow employers to access information about the criminal records of job applicants or employees for a variety of reasons.  For some employers, enforced subject access requests have been a condition of employment.

Current position

Currently, such requests can be used to reveal details of any criminal convictions that the individual has, which includes information to which employers would not otherwise have access.  For example, a subject access request made to the Police for information about an individual's criminal convictions would reveal more details than the individual would otherwise have to declare to his employer.  For example, that information might include spent convictions under the Rehabilitation of Offenders Act 1974.

Both the Information Commissioner and the Disclosure and Barring Service have expressed concern that enforced subject access requests not only represent an abuse of an individual’s rights but also potentially undermine important public policies.

New law

Section 56 will prohibit a person from requiring an individual to produce certain records as a condition of employment or for providing a service, other than where the relevant record is required by law or where it is justified in the public interest.

Issues for employers

The coming into force of section 56 will not prevent employers from carrying out Disclosure and Barring Service checks in relation to the recruitment of employees to occupations covered by the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975.  For jobs that do not fall within the exceptions, however, employers will risk a fine of £5,000 in the Magistrates Court or an unlimited fine in the Crown Court if they seek to force an applicant to provide their criminal record by making a subject access request.  It is worth noting that the Information Commissioner’s Office has indicated that it intends to prosecute those who continue to make enforced subject access requests in an effort to stamp out this practice therefore such fines are a very real possibility.

What should employers do?

Employers should review their recruitment practices and standard documents, particularly if offers of employment are currently made subject to the production of a clean criminal record.

It is possible for employers simply to ask applicants or employees to disclose their criminal records voluntarily but they should explain to individuals that they do not need to disclose spent convictions.  However, there is no certainty that the individuals would provide accurate information.